Vulnerability for Puzzle#2: Relay attack. In Puzzle#1, somebody have sent a tx with whose <SHA256 of subscribed email> in the unlock script.